Zero-Click Spyware Infects Phones Through Targeted Ads, Researchers Warn

Spyware Hidden in Ads

Researchers at The Citizen Lab at the University of Toronto have disclosed a campaign they call AdFection, in which spyware silently infected devices as users simply browsed past advertisements. The investigation, published on Thursday, links an Israeli-registered advertising firm to servers associated with the Israeli spyware developer Candiru.

Citizen Lab said 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered through ads during 2024 and 2025. According to the researchers' analysis, infected devices first contacted domains linked to the Israeli-founded marketing firm Discover-Tech and then connected to Candiru infrastructure. The researchers believe this is the first detailed public technical evidence of sophisticated spyware infecting devices through digital ads.

Zero-click attacks install malware without any interaction from the target. Senior researcher Bill Marczak said victims would notice nothing unusual and might not even see an ad at all.

Industry and Platform Response

Google said it blocked Discover-Tech from its ad platforms after a joint investigation with Citizen Lab and the cybersecurity firm Confiant confirmed the spyware link. The company also set up Safe Browsing warnings for websites linked to the group.

IAB Europe confirmed it suspended Discover-Tech from its global vendor list after an audit of its policies, and said further confirmation of spyware findings could justify definitive expulsion. Beeswax, an online advertising company owned by Comcast, said it removed Discover-Tech from its platform and maintains a zero-tolerance policy for malicious advertising.

Discover-Tech and its CEO did not respond to requests for comment, nor did Integrity Partners, which is believed to own Candiru's assets following US government sanctions in 2021. Al Jazeera, which shared device logs with the researchers, also did not respond.

How Ad Infrastructure Enables Targeting

Citizen Lab said Discover-Tech operates an advertising platform called Controlium, which its researchers say can de-anonymize, fingerprint, and automatically infect devices once an ad appears. The researchers estimate millions of devices were directed to Candiru's servers, where they could be profiled.

By analyzing publicly exposed ad-bidding records on Discover-Tech's website, the researchers found ads linked to the firm were shown in more than 70,000 mobile apps and more than 120,000 websites between March and June of this year. Multiple apps each displayed more than a million ads linked to Discover-Tech, and the researchers said ad impressions appeared on networks including NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure providers, and armed forces and government agencies in Norway and Sweden.

Wolfie Christl, a senior Citizen Lab researcher, called the risk of device infection simply from using a website or app that displays ads a nightmare scenario, noting that blocking ads thoroughly is the main protection available to individuals.

Sources: Wired · Cyberscoop · Citizen Lab · Techmeme